@podosoft/podokit 0.17.1 → 0.17.3

package/dist/dev.js

@@ -156,10 +156,15 @@ function writeRuntimeFiles(runtime) {
     (0, node_fs_1.writeFileSync)(runtime.runtimeComposePath, renderRuntimeCompose(runtime));
 }
 function registerRoute(runtime) {
-    const collision = activeEntries().find((entry) => entry.hostname === runtime.config.hostname && entry.projectRoot !== runtime.projectRoot);
+    const entries = activeEntries();
+    const collision = entries.find((entry) => entry.hostname === runtime.config.hostname && entry.projectRoot !== runtime.projectRoot);
     if (collision) {
         throw new Error(`Development hostname ${runtime.config.hostname} is already registered by ${collision.projectRoot}. Change .podokit/dev.json or run podo dev down there.`);
     }
+    for (const stale of entries.filter((entry) => entry.projectRoot === runtime.projectRoot && entry.routeId !== runtime.routeId)) {
+        (0, node_fs_1.rmSync)((0, node_path_1.join)(registryDirectory(), `${stale.routeId}.json`), { force: true });
+        (0, node_fs_1.rmSync)((0, node_path_1.join)(routesDirectory(), `${stale.routeId}.yml`), { force: true });
+    }
     (0, node_fs_1.mkdirSync)(registryDirectory(), { recursive: true });
     (0, node_fs_1.mkdirSync)(routesDirectory(), { recursive: true });
     (0, node_fs_1.writeFileSync)(routePath(runtime), renderRoute(runtime));
@@ -307,6 +312,23 @@ function runDevCommand(projectRoot, action, args, runner = defaultRunner) {
         }
         return;
     }
+    if (action === "up") {
+        ensureNetwork(runner);
+        registerRoute(runtime);
+        try {
+            ensureGateway(runner);
+            process.stdout.write(`Development URL: http://${runtime.config.hostname}\n`);
+            if (runtime.config.publicUrl)
+                process.stdout.write(`Public OAuth URL: ${runtime.config.publicUrl}\n`);
+            runCompose(runtime, composeCommand("up", args, profiles), runner);
+        }
+        catch (error) {
+            unregisterRoute(runtime);
+            stopGatewayWhenUnused(runner);
+            throw error;
+        }
+        return;
+    }
     if (action === "down") {
         runCompose(runtime, composeCommand("down", args, profiles), runner);
         unregisterRoute(runtime);
@@ -317,5 +339,5 @@ function runDevCommand(projectRoot, action, args, runner = defaultRunner) {
         runCompose(runtime, composeCommand(action, args, profiles), runner);
         return;
     }
-    throw new Error("Usage: podo dev <watch|exec|logs|ps|down|url> [docker compose options]");
+    throw new Error("Usage: podo dev <watch|up|exec|logs|ps|down|url> [docker compose options]");
 }

package/dist/templates/fullstack-nest-svelte/README.md

@@ -27,6 +27,7 @@ Run lifecycle and container commands from a second terminal:
 
 ```bash
 npx @podosoft/podokit dev url
+npx @podosoft/podokit dev up -d # detached stack without source watching
 npx @podosoft/podokit dev ps
 npx @podosoft/podokit dev logs
 npx @podosoft/podokit dev exec api npm run migration:run -w {{projectName}}-api
@@ -35,6 +36,8 @@ npx @podosoft/podokit dev down
 
 `dev watch` reads `.podokit/manifest.json` and automatically activates `cache`,
 `storage`, and `queue` when installed modules require Redis, MinIO, or a worker.
+`dev up` uses the same shared gateway and module profiles without keeping Compose
+Watch attached.
 You can still activate an additional Compose profile explicitly:
 
 ```bash

package/dist/templates/modules/admin-dashboard/files/apps/web/src/lib/components/account-page.svelte

@@ -384,6 +384,8 @@
   }
 
   // Sessions — this user's own devices
+  /** better-auth's code for "this session is older than `session.freshAge`". */
+  const SESSION_NOT_FRESH = "SESSION_NOT_FRESH";
   type Session = { id: string; token: string; userAgent?: string | null; ipAddress?: string | null; createdAt: string | Date };
   const PAGE_SIZE = DEFAULT_PAGE_SIZE;
   let sessions = $state<Session[]>([]);
@@ -397,8 +399,30 @@
     { key: "status", label: i18n.t.sessions.status },
     { key: "actions", label: "", class: "w-10" },
   ];
+  /**
+   * True when the session is too old to list sessions.
+   *
+   * better-auth guards `/list-sessions` (and `/unlink-account`) with its freshness
+   * middleware, and `session.freshAge` defaults to 24 hours. So for anyone who signed
+   * in yesterday — which is most people, most of the time — this call returns 403
+   * `SESSION_NOT_FRESH`. It is not a failure to report as one: the tab has to say what
+   * happened and what to do, or it is a blank table under an untranslated toast.
+   */
+  let sessionsStale = $state(false);
+  async function signOutToRefresh(): Promise<void> {
+    busy = true;
+    await api.auth.signOut();
+    await goto("/login", { invalidateAll: true });
+  }
   async function loadSessions(): Promise<void> {
     const { data: res, error } = await api.auth.listSessions();
+    if (error?.code === SESSION_NOT_FRESH) {
+      // Explained in the panel below, not thrown at the corner of the screen.
+      sessionsStale = true;
+      sessions = [];
+      return;
+    }
+    sessionsStale = false;
     if (error) return void toast.error(error.message ?? i18n.t.sessions.loadFailed);
     // Current session first (users expect it on top; also keeps it on page 1),
     // then newest to oldest.
@@ -791,9 +815,21 @@
         <Card.Root>
           <Card.Header class="flex flex-row items-center justify-between gap-2">
             <Card.Title>{i18n.t.sessions.title}</Card.Title>
-            <Button variant="outline" size="sm" disabled={busy || sessions.length <= 1} onclick={signOutOthers}>{i18n.t.sessions.signOutOthers}</Button>
+            <Button variant="outline" size="sm" disabled={busy || sessionsStale || sessions.length <= 1} onclick={signOutOthers}>{i18n.t.sessions.signOutOthers}</Button>
           </Card.Header>
           <Card.Content>
+            {#if sessionsStale}
+              <!-- The list is withheld by the server, so the card explains the rule and
+                   offers the only thing that satisfies it. A toast would have scrolled
+                   away and left an empty table behind it. -->
+              <div class="flex flex-col items-start gap-3" data-testid="sessions-stale">
+                <p class="text-muted-foreground text-sm">{i18n.t.sessions.staleTitle}</p>
+                <p class="text-muted-foreground text-xs">{i18n.t.sessions.staleHint}</p>
+                <Button variant="outline" size="sm" disabled={busy} onclick={signOutToRefresh} data-testid="sessions-stale-signin">
+                  {i18n.t.sessions.staleAction}
+                </Button>
+              </div>
+            {:else}
             <DataTable
               columns={sessionsColumns}
               rows={sessions}
@@ -815,6 +851,7 @@
                 </Table.Cell>
               {/snippet}
             </DataTable>
+            {/if}
           </Card.Content>
         </Card.Root>
       {:else if section === "apiKeys"}

package/dist/templates/modules/admin-dashboard/files/apps/web/src/lib/i18n/catalogs/admin-dashboard/en.json

@@ -483,7 +483,10 @@
     "switchAccount": "Switch",
     "switchFailed": "Failed to switch account",
     "othersRevoked": "Signed out other sessions",
-    "total": "{count} sessions"
+    "total": "{count} sessions",
+    "staleTitle": "Sign in again to see where you are signed in.",
+    "staleHint": "For your security this list is only shown to a session that signed in recently.",
+    "staleAction": "Sign in again"
   },
   "adminSessions": {
     "title": "User sessions",

package/dist/templates/modules/admin-dashboard/files/apps/web/src/lib/i18n/catalogs/admin-dashboard/ko.json

@@ -483,7 +483,10 @@
     "switchAccount": "전환",
     "switchFailed": "계정 전환에 실패했습니다",
     "othersRevoked": "다른 세션을 모두 종료했습니다",
-    "total": "세션 {count}개"
+    "total": "세션 {count}개",
+    "staleTitle": "어디에서 로그인되어 있는지 보려면 다시 로그인하세요.",
+    "staleHint": "보안을 위해 이 목록은 최근에 로그인한 세션에만 보여줍니다.",
+    "staleAction": "다시 로그인"
   },
   "adminSessions": {
     "title": "사용자 세션",

package/dist/templates/modules/admin-dashboard/files/tests/ui/account.ui.spec.ts

@@ -170,6 +170,39 @@ test("account security and sessions sub-navigation", async ({ page }) => {
   await expect(page.getByRole("button", { name: "Sign out other sessions" })).toBeVisible();
 });
 
+/**
+ * ⚠ THE SUITE ALWAYS SIGNS IN FIRST, WHICH IS WHY THIS NEEDED A MOCK.
+ *
+ * better-auth guards `/list-sessions` with its freshness middleware and
+ * `session.freshAge` defaults to 24 hours, so the endpoint returns 403
+ * `SESSION_NOT_FRESH` to anyone who signed in yesterday. The seeded session is
+ * minutes old, so the test above passes for every run while the screen is broken for
+ * real users — the tab showed an empty table under an untranslated "Session is not
+ * fresh" toast. Forcing the response is the only way to reach the state the suite's
+ * own setup prevents.
+ */
+test("sessions tab explains a session that is too old to list them", async ({ page }) => {
+  await page.route("**/api/auth/list-sessions", (route) =>
+    route.fulfill({
+      status: 403,
+      contentType: "application/json",
+      body: JSON.stringify({ message: "Session is not fresh", code: "SESSION_NOT_FRESH" }),
+    }),
+  );
+
+  await ready(page, "/admin/account");
+  await page.getByRole("button", { name: "Sessions" }).click();
+
+  const panel = page.getByTestId("sessions-stale");
+  await expect(panel).toBeVisible();
+  // The raw upstream string must not be what a person reads.
+  await expect(page.getByText("Session is not fresh")).toHaveCount(0);
+  // And the one action that satisfies the rule is offered rather than described.
+  await expect(page.getByTestId("sessions-stale-signin")).toBeVisible();
+  // Revoking is meaningless while the list is withheld, so it is not offered either.
+  await expect(page.getByRole("button", { name: "Sign out other sessions" })).toBeDisabled();
+});
+
 // Changing a password is the one form here whose mistake is silent: the change
 // succeeds, and the person finds out at the next sign-in with a password they
 // cannot reproduce.

package/dist/templates/todo/README.md

@@ -28,6 +28,7 @@ In a second terminal, apply the included Todo migration and use the lifecycle he
 ```bash
 npx @podosoft/podokit dev exec api npm run migration:run -w {{projectName}}-api
 npx @podosoft/podokit dev url
+npx @podosoft/podokit dev up -d # detached stack without source watching
 npx @podosoft/podokit dev ps
 npx @podosoft/podokit dev logs
 npx @podosoft/podokit dev down
@@ -35,6 +36,8 @@ npx @podosoft/podokit dev down
 
 `dev watch` reads `.podokit/manifest.json` and automatically activates `cache`,
 `storage`, and `queue` when installed modules require Redis, MinIO, or a worker.
+`dev up` uses the same shared gateway and module profiles without keeping Compose
+Watch attached.
 You can still activate an additional Compose profile explicitly:
 
 ```bash

package/dist/update.js

@@ -151,6 +151,14 @@ function planUpdate(projectRoot, templatesDir) {
         const classified = (0, lockfile_1.classifyTier)(path, newText ?? disk ?? "", ownedGlobs, managedOverrides);
         const tier = controlledByTarget ? classified : locked?.tier ?? classified;
         if (tier === "owned") {
+            // A file introduced by a newer template or module has no previous lock
+            // entry. Seed it once when the application has not already claimed that
+            // path; subsequent edits or deletions stay protected by the recorded
+            // owned entry.
+            if (!locked && disk === null && newText !== null) {
+                changes.push({ path, tier, action: "add", note: "new owned seed in this version" });
+                continue;
+            }
             const explicitlyOwned = ownedGlobs.some((glob) => !glob.includes("*") && (0, lockfile_1.matchGlob)(path, glob));
             changes.push({
                 path,
@@ -283,6 +291,18 @@ function updatedFilesLock(projectRoot, newTree, previous, ownedGlobs, managedOve
             delete next.files[path];
         }
     }
+    // Keep a tombstone for an owned seed that the application deleted or moved.
+    // Without the previous entry, the next update would mistake the missing path
+    // for a newly introduced seed and recreate it.
+    for (const [path, entry] of Object.entries(previous.files)) {
+        if (entry.tier !== "owned" || next.files[path])
+            continue;
+        const newText = treeText(newTree, path);
+        if (newText !== null &&
+            (0, lockfile_1.classifyTier)(path, newText, ownedGlobs, managedOverrides) === "owned") {
+            next.files[path] = entry;
+        }
+    }
     return next;
 }
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@podosoft/podokit",
-  "version": "0.17.1",
+  "version": "0.17.3",
   "description": "An opinionated but extensible starter toolkit and CLI for full-stack TypeScript apps with NestJS, SvelteKit, TailwindCSS, shadcn-svelte, Docker, and k3s.",
   "license": "Apache-2.0",
   "repository": {